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CLAIMS 

^y^*)--j \ 1 . An encryption apparatus for converting 

plaVntext block into a ciphertext block depending on 
supplied key information, comprising: 

means for randomly selecting one pattern of each 
of pairs ai, ai (where i is a positive integer not less 
than one^ of one or a plurality of predetermined mask 
patterns Wnd mask patterns obtained by bit inversion of 
the prede-pprmined mask patterns every time encryption 
10 is per forme 

means Aor masking bits dependent on a plaintext 
within said a^pparatus with the mask patterns selected 
by said selection means; and 

means for Removing an influence of the mask ^ from 
15 a ciphertext befbre the ciphertext is output • 

2, An encryption apparatus for converting a 
plaintext block into a ciphertext block depending on 
supplied key information, comprising: 

means for randorl^ly selecting one pattern of each 
20 of pairs ai, ai (wherfe i is a positive integer not less 

than one) of one or a pij.urality of predetermined mask 
patterns and mask patterns obtained by bit inversion of 
the predetermined mask patterns every time encryption 
is performed; 

25 means for masking interitfediate bit data within 

said apparatus with the mask pastterns selected by said 
selection means; and 
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means for removing an influence of the mask ^ from 
the intermediate bit data masked by said masking means. 

3 . An encryption apparatus for converting a 
plaintext clock into a ciphertext block depending on 
supplied ke^ information, comprising: 

data translation means for performing data 
translation Ao intermediate data within said apparatus; 

means fot randomly selecting one pattern of each 
of pairs ai, a^ (where i is a positive integer not less 
10 than one) of on^ or a plurality of predetermined mask 

patterns and mask patterns obtained by bit inversion of 
the predetermineoy mask patterns every time encryption 
is performed; 

means for masking an input to said data 
15 translation means wAth the mask patterns selected by 

said selection means ;\ and 

means for removing an influence of the mask ^ from 
an output from said datV translation means which is 
masked by said masking m^ans, 
20 4 . An apparatus according to claim 1, wherein 

said means for masking theXbits dependent on the 
plaintext within said apparatus with the selected mask 
patterns and said means for Aemoving the influence 
of the mask ^ from the cipher-bext comprise one of 
25 an exclusive OR, addition or subtraction with respect 

to a modulus, and multiplication\or division with 
respect to the modulus . 
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5. \ An apparatus according to claim 2, wherein 
said meaAs for masking the intermediate bit data within 
said apparatus with the selected mask patterns and said 
means for :Eemoving the influence of the mask a from 
5 the masked intermediate bit data comprise one of an 

exclusive Or\ addition or subtraction with respect to 
a modulus, ana multiplication or division with respect 
to the modulus\. 

6 • An apparatus according to claim 3, wherein 

£ f~: \ 

l2 10 said data transudation means, said means for masking the 

input to said da-^a translation means with the selected 
mask patterns, and said means for removing the 
influence of the mask ^ from the masked output from 
said data translation means comprise one of an 
15 exclusive OR, addition or subtraction with respect to 

a modulus, and multiplication or division with respect 
to the modulus. 

7. An apparatus ac^cording to claim 3, further 
comprising : 

20 first storage means fox storing, in the form of 

a table, said means for randcjmly selecting one pattern 
of each of the pairs ai, ai (Vhere i is a positive 
integer not less than one) of one or the plurality of 
predetermined mask patterns and Vhe mask patterns 
2 5 obtained by bit inversion of the ©redetermined mask 

patterns every time encryption is performed, said means 
for masking the input to said data tVanslation means 



\ 
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with the Aiask patterns ai, and said means for removing 
the influeVice of the masks ai from the masked output 
from said aata translation means; 

second\ storage means for storing, in the form of 
5 a table, saiti means for masking the input to said data 

translation means with mask patterns a , and said means 
for removing an influence of the masks a from the 
masked output from said data translation means; and 
masked datV translation means for randomly 
:^ 10 selecting one of\ said first and second storage means 

./t every time encryption is performed, and performing the 

y processing by said data translation means for masked 

=1= data. 
D 8. An apparatus according to claim 1, wherein the 

15 pair a, a of the mask patterns and the mask patterns 

ku obtained by bit inversion comprises a pair a, a of 

predetermined fixed. ma^k patterns and mask patterns 
obtained by bit inversx^n of the fixed mask patterns, 

9, An apparatus according to claim 1, wherein the 
20 pair a, a of the mask patterns and the mask patterns 

obtained by bit inversion^re not necessarily concealed, 

10. An apparatus according to claim 1, wherein 
a Hamming weight indicating^the number of bits "Is" 
of an n-bit long bit sequence 5s is defined as H(x), 

25 and the Hamming weight H(a) of the mask ^ satisfies 

0 < H(a) < n. 

11. An apparatus accordingVto claim 1, wherein 
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a Hamming weight indicating the number of bits "Is" of 
an n-bit\long bit sequence x is defined as H(x), and 
an absolute value of a difference between the Hamming 
weight H(a)y of the mask ^ and a Hamming weight H(a) of 
5 bit inversion a of the mask ^ is less than n/2. 

12 . A decryption apparatus for converting a 
ciphertext block into a plaintext block depending on 
supplied key information, comprising: 

means for l^andomly selecting one pattern of each 
10 of pairs ai, ai Vwhere i is a positive integer not less 

than one) of one or a plurality of predetermined mask 
patterns and mask patterns obtained by bit inversion of 
the predetermined m^\sk patterns every time decryption 
is performed; 

15 means for masking bits dependent on a ciphertext 

within said apparatus wath the mask patterns selected 

by said selection means ;\ and 

means for removing an influence of the mask a from 

a plaintext before the plai^ntext is output. 
20 13, A decryption appara^tus for converting a 

ciphertext block into a plaintext block depending on 

supplied key information, comprising: 

means for randomly selecting one pattern of each 

of pairs ai, ai (where i is a pos^itive integer not less 
2 5 than one) of one or a plurality of \predetermined mask 

patterns and mask patterns obtained \by bit inversion of 

the predetermined mask patterns everA time decryption 
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is performed; 

means for masking intermediate bit data within 
said apparatus with the mask patterns selected by said 
selectioA means ; and 

means for removing an influence of the mask ^ from 
the intermediate bit data masked by said masking means, 

14. A decryption apparatus for converting a 
ciphertext block into a plaintext block depending on 
supplied key information, comprising: 

data translation means for performing data 
translation to intermediate data within said apparatus; 

means for randomly selecting one pattern of each 
of pairs ai, ai (wnere i is a positive integer not less 
than one) of one or a plurality of predetermined mask 
patterns and mask patterns obtained by bit inversion of 
the predetermined maskXpatterns every time decryption 
is performed; \ 

means for masking an input to said data transla- 
tion means with the mask patterns selected by said 
selection means; and \ 

means for removing an influence of the mask ^ from 
an output from said data translation means which is 
masked by said masking means. \ 

15. An apparatus accordingXto claim 12, wherein 
said means for masking the bits aependent on the 
plaintext within said apparatus with the selected mask 
patterns and said means for removiAg the influence of 



• 
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the mask ^ from the ciphertext comprise one of an 
exclusive OR, addition or subtraction with respect to 
a moduAus, and multiplication or division with respect 
to the modulus, 

16 • \An apparatus according to claim 13, wherein 
said means for masking the intermediate bit data within 
said apparatus with the selected mask patterns and said 
means for removing the influence of the mask a from 
the masked i\itermediate bit data comprise one of an 
10 exclusive OR, \ addition or subtraction with respect to 

a modulus m, and multiplication or division with 
respect to the modulus 

17. An appaas;atus according to claim 15, wherein 
said data translat5\3.on i^fe^ns, said means for masking the 
15 input to said data ^^ransl/arfeion means with the selected 

mask patterns, and ScLLd means for removing the 
influence of the mask ^a'^f^rbm the masked output from 
said data translation iti'fe^ns comprise one of an 
exclusive OR, addition o2\ subtraction with respect to 
2 0 a modulus, and multiplication or division with respect 

to the modulus, 

— apparatus according to claim 14, further 
-Sine 

first Storage means for storing, in the form of 
25 a table, sai^ means for randomly selecting one pattern 

of each of thA pairs ai, ai (where i is a positive 
integer not lesa than one) of one or the plurality of 
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predeteVmined mask patterns and the mask patterns 
obtainedXby bit inversion of the predetermined mask 
patterns every time decryption is performed, said means 
for masking the input to said data translation means 
5 with the mask patterns ai, and means for removing the 

influence of^^i^he masks ai from the masked output from 
said data translation means; 

second s-^rage means for storing, in the form of 
Q a table, means for masking the input to said data 

"if^ 10 translation means with mask patterns a , and means for 



removing an influence of the masks a from the masked 
output from said data translation means; and 

masked data trxanslation means for randomly 
selecting one of sa:nd first and second storage means 
15 every time decryption is performed, and performing the 

processing by said da-Q^ translation means for masked 
data. 

19. An apparatus according to claim 12, wherein 
the pair a, a of the mask, patterns and the mask 

2 0 patterns obtained by bit inversion comprises a pair 

a, a of predetermined f ixed\ mask patterns and mask 
patterns obtained by bit inve^rsion of the fixed mask 
patterns . 

20. An apparatus according to claim 13, wherein 
2 5 the pair ai, ai of the mask patterns and the mask 

patterns obtained by bit inversiqn are not necessarily 
concealed. 
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:i. An apparatus according to claim 12, wherein 
a Hamfhing weight indicating the number of bits "Is" 
of an n-bit long bit sequence x is defined as H(x), 
and the\Hamming weight H(a) of the mask ^ satisfies 
0 < H ( a ) Vc n . 

22, ^ apparatus according to claim 12, wherein 
a Hamming v^ight indicating the number of bits "is" of 
an n-bit long bit sequence 2c is defined as H(x), and 
an absolute vAlue of a difference between the Hamming 
weight H(a) of >the mask ^ and a Hamming weight H(a) of 
bit inversion a \of the mask a is less than n/2, 

23. An encryption method of converting a plaintext 
block into a cipheEtext block depending on supplied key 
information, comprisying the steps of: 

randomly selecting one pattern of each of pairs 



\ 



ai, ai (where i is a positive integer not less than 
one) of one or a plurality of predetermined mask 
patterns and mask patterns^ obtained by bit inversion of 
the predetermined mask patt<^rns every time encryption 
is performed; 

masking bits dependent oriy a plaintext within the 
method with the selected mask patterns; and 

removing an influence of the mask ^ from 
a ciphertext before the ciphertextv is output. 

24. An encryption method of co\iverting a plaintext 
block into a ciphertext block depending on supplied key 
information, comprising the steps of: 
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randoinly selecting one pattern of each of pairs 
ai, ai (whejre i is a positive integer not less than 
one) of one pr a plurality of predetermined mask 
patterns andWask patterns obtained by bit inversion of 
5 the predetermined mask patterns every time encryption 

is performed; 

masking intermediate bit data within the method 
with the selected mask patterns; and 

removing an \nfluence of the mask a from the 
10 masked intermediate bit data, 

J*^ 25. An encryptiV>n method of converting a plaintext 

5^ block into a ciphertext block depending on supplied key 

information, comprising the steps of: 
Q performing data tro^nslation to intermediate data 

H 15 within the method; 

^0 randomly selecting one pattern of each of pairs 

ai, ai (where i is a positive integer not less than 
one) of one or a plurality of\ predetermined mask 
patterns and mask patterns obtained by bit inversion of 
20 the predetermined mask patterns \every time encryption 

is performed; 

masking an input to the data \translation step with 
the selected mask patterns; and 

removing an influence of the ma^k ^ from a masked 
25 output from the data translation step\ 

26, A method according to claim 23^ wherein the 
step of masking the bits dependent on the plaintext 
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within the method with the selected mask patterns 
and the step of removing the influence of the mask ^ 
from the ciphertext comprise one of an exclusive OR, 
addition or subtraction with respect to a modulus, and 
multiplication or division wi/th respect to the modulus. 

21. A method according /to claim 24, wherein the 
step of masking the intermediate bit data within the 
method with the selected mask patterns and the step of 
removing the influence of the mask m from the masked 
intermediate bit data comprise one of an exclusive OR, 



/ : 



addition or subtraction with respect to a modulus, and 
multiplication or division with respect to the modulus. 

28. A method according to claim 25, wherein the 
data translation step, the step of masking the input 
to the data translation step with the selected mask 
patterns, and the ^step of removing the influence of the 
mask ^ from the unasked output from the data translation 
step comprise one of an exclusive OR, addition or 
subtraction with' respect to a modulus, and multiplica- 
tion or division with respect to the modulus. 

29. A method according to claim 25, further 
comprising the/ steps of: 

storing, /in the form of a table, the step of 
randomly selecting one pattern of each of the pairs 

.s a positive integer not less than 



ai, ai (where i is 
one) of one or the plurality of predetermined mask 



patterns and 



the mask patterns obtained by bit 
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inversion of the predetermined mask pa'tterns every time 
encryption is performed, the step of /masking the input 
to said data translation step with^the mask patterns ai, 
and the step of removing the influence of the masks ai 
5 from the masked output from the y^ata translation step; 

storing, in the form of a/table, the step of 
masking the input to said data translation step with 
mask patterns a , and step of removing an influence 
1^. of the masks a from the masked output from the data 

|7J 10 translation step; and 

randomly selecting /one of the first and second 
:J Storage steps every ti^e encryption is performed, and 

performing the processing in the data translation step 
y for masked data. 

H 15 30. A method according to claim 23, wherein the 

^fi - / 

pair a, a of the mask patterns and the mask patterns 
obtained by bit inversion comprises a pair a, a of 
predetermined fisced mask patterns and mask patterns 
obtained by biy inversion of the fixed mask patterns. 
20 31. A met^hod according to claim 23, wherein that 

the pair a, a/ of the mask patterns and the mask 
patterns obt4ined by bit inversion are not necessarily 
concealed. 

32. A^ method according to claim 23, wherein 
25 a Hamming/ weight indicating the number of bits "Is" 

of an n-bit long bit sequence x is defined as H(x), 
and the Hamming weight H(a) of the mask ^ satisfies 
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0 < H(a) < n. / 

33. A method according to ci^im 23, wherein 

a Hamming weight indicating the number of bits "Is" of 
an n-bit long bit sequence^ is defined as H(x), and 
an absolute value of a di/fference between the Hamming 
weight H(a) of the masj/^ and a Hamming weight H(a) of 
bit inversion a of the mask ^ is less than n/2. 

34. A decryption method of converting a ciphertext 
block into a plairitext block depending on supplied key 
information, comprising the steps of: 

randomly ^electing one pattern of each of pairs 
ai, ai (where i is a positive integer not less than 
one) of one yor a plurality of predetermined mask 
patterns and mask patterns obtained by bit inversion of 
the predetermined mask patterns every time decryption 
is performed; 

masking bits dependent on a ciphertext within the 
method ywith the selected mask patterns; and 

removing an influence of the mask ^ from 
a plaintext before the plaintext is output. 

J 5 . A decryption method of converting a ciphertext 
block into a plaintext block depending on supplied key 
inf c/rmation, comprising the steps of: 



/ randomly selecting one pattern of each of pairs 
ai, ai (where i is a positive integer not less than 
one) of one or a plurality of predetermined mask 
patterns and mask patterns obtained by bit inversion of 
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the predetermined mask patterns every time decryption 
is performed; 

masking\intermediate bit data within the method 
with the selected mask patterns; and 
5 removing an influence of the mask ^ from the 

masked intermediate bit data. 

36. A decryption method of converting a ciphertext 
block into a plaii^text block depending on supplied key 

s=i information, comprising the steps of: 

10 performing dat'^ translation to intermediate data 

."I within the method; 

5^ randomly selectiiig one pattern of each of pairs 

ai, ai (where i is a positive integer not less than 
O one) of one or a plurality of predetermined mask 

1=^ 15 patterns and mask patternsX obtained by bit inversion of 

^.Q the predetermined mask patterns every time decryption 

is performed; 

masking an input to the d^ata translation step with 
the selected mask patterns; and 
20 removing an influence of thdy mask ^ from a masked 

output from the data translation sVep. 

37. A method according to claim 34, wherein 
that the step of masking the bits dependent on the 
ciphertext within the method with the selected mask 

2 5 patterns and the step of removing the influence of the 

mask ^ from the plaintext comprise one on an exclusive 
OR, addition or subtraction with respect to a modulus 



and multipi|ication or division with respect to the 
modulus iz. 

38. A lAethod according to claim 35, wherein the 
step of masking the intermediate bit data within the 
method with selected mask patterns and the step of 
removing the influence of the mask m from the masked 
intermediate iLlt data comprise one of an exclusive OR, 
addition or subtraction with respect to a modulus, and 
multiplication or division with respect to the modulus, 

39. A method according to claim 36, wherein the 
data translation step, the step of masking the input 
to the data transTation step with the selected mask 



patterns, and the s^ep of removing the influence of the 
mask a from the masked output from the data translation 
step comprise one of^an exclusive OR, addition or 
subtraction with respect to a modulus, and multiplica- 
tion or division with :^espect to the modulus. 

40. A method according to claim 36, further 
comprising the steps of: \ 

storing, in the f orm pf a table, the step of 
randomly selecting one pattern of each of the pairs 
ai, ai (where i is a positive integer not less than 
one) of one or the plurality of predetermined mask 

patterns and the mask patternX obtained by bit 

\ 

inversion of the predetermined mask patterns every time 
decryption is performed, the step^of masking the input 
to said data translation step with the mask patterns ai. 
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and the step of removing the influence of the masks ai 
from trie masked output from the data translation step; 

storing, in the form of a table, the step of 
masking tiie input to said data translation step with 
mask pattemis a , and step of removing an influence 
of the masksV a from the masked output from the data 
translation sltep; and 

randomly selecting one of the first and second 
storage steps ev^ry time decryption is performed, and 
performing the progressing in the data translation step 
for masked data. 

41, A method acc\Drding to claim 34, wherein the 
pair a, a of the mask patterns and the mask patterns 
obtained by bit inversioFi comprises a pair a, a of 
predetermined fixed mask patterns and mask patterns 
obtained by bit inversion oiv the fixed mask patterns. 

42. A method according t(s) claim 34, wherein the 
pair a, a of the mask patternsXand the mask patterns 
obtained by bit inversion are noV necessarily concealed- 

"^^^X^ ^^=<Z — ^"^ thod according to claim 34, wh eredri^ 



a Hamming w&i^ht indicating the number of bits "Is" 
of an n-bit long B^rfe^equence 2£ is defined as H(x), 
and the Hamming weight H^"a^of the mask a satisfies 
0 < H(a) < n. 

44. A method according to claim^34^ wherein 
a Hamming weight indicating the number of Bits "Is" 
of an n-bit long bit sequence x is defined as H(X) # and 
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an absolute value o?"'"""^:'"--di4ference between the Hamming 
weight H(a) of the mask ^ and a HamnTtrtg-Jaje^ H(a) of 
i i-i wMh u iM i i ^ Mr MiM fTVP».a4<^- ja^ T g 1 pss tti an ^ n/2 > 
46. A computer-usable program storage medium 
storing computer-readable program code means for 
converting a plaintext block into a ciphertext block 
depending on supplied key information, comprising: 

computer-readable program code means for causing 
a computer to randomly select one pattern of each of 
pairs aL ai (where i is a positive integer not less 
than one! of one or a plurality of predetermined mask 
patterns Wnd mask patterns obtained by bit inversion of 
the predetermined mask patterns every time encryption 
is performed; 

computer-readable program code means for causing 
said computer to mask bits dependent on a plaintext 
within the method with the selected mask patterns; and 

computer-readable program code means for causing 
said computer to remove an influence of the mask ^ from 
a ciphertext ^bef ore the ciphertext is output. 
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46. An encryption apparatus for converting 
a plaintext block into a ciphertext block depending 
on supplied key information, comprising: 

means for ^randomly selecting one pattern of each 
of pairs ai, ai Wwhere i is a positive integer not less 
than one) of one \or a plurality of predetermined mask 
patterns and mask \patterns obtained by bit inversion of 



the predertermined mask patterns every time encryption 
is performed; 

meansl for masking bits dependent on a key within 
said apparatus with the mask patterns selected by said 
selection means; 

data translation means for converting intermediate 
data within said apparatus with the key; and 

means for removing an influence of the mask ^ from 
an output f rom\ said data translation means. 

47. An apparatus according to claim 46, wherein 
the pair a, a cxf the mask patterns and the mask 
patterns obtained by bit inversion comprises a pair 

a^ a of predetermined fixed mask patterns and mask 
patterns obtained by bit inversion of the fixed mask 
patterns. \ 

48. An apparati^ according to claim 46, wherein 
the pair a, a of the\mask patterns and the mask 
patterns obtained by pit inversion are not necessarily 
concealed. \ 

49. An apparatus according to claim 46, wherein 
a Hamming weight indicating the number of bits "Is" 
of an n-bit long bit sequence x is defined as H(x), 
and the Haimning weight H(a)\of the mask ^ satisfies 

0 < H(a) < n. \ 

50. An apparatus according to claim 46, wherein 

a Hamming weight indicating the number of bits "Is" of 
an n-bit long bit sequence x isXdefined as H(x), and 



an absolute value of a difference between the Hamming 
weight H(aM of the mask ^ and a Hamming weight H(a) of 
bit inversi^pn a of the mask is less than n/2. 




